Daily Security Review

This podcast dives deep into one of the most pressing vulnerabilities in modern AI — the rise of sophisticated "jailbreaking" attacks against large language models (LLMs). Our discussion unpacks a critical briefing on the evolving landscape of these attacks, with a spotlight on the novel “Echo Chamber” technique discovered by NeuralTrust. Echo Chamber weaponizes context poisoning, indirect prompts...

In this episode, we dive deep into the alarming revelations about Salt Typhoon—a Chinese state-sponsored advanced persistent threat (APT) actor, also known as RedMike, Earth Estries, FamousSparrow, GhostEmperor, and UNC2286. Backed by China’s Ministry of State Security (MSS), this group has been running extensive cyber espionage operations since at least 2023, with a focus on telecommunication gia...

In this eye-opening episode, we break down a sophisticated new trend in tech support scams (TSS) that’s catching even the most cautious users off guard. Scammers are now hijacking Google Ads and manipulating search results to funnel users—who are simply looking for help—to malicious phone numbers injected directly into legitimate websites like Apple, Microsoft, Netflix, and major banks. Clicking o...

In this episode, we take a deep dive into the Qilin ransomware group — now regarded as the world’s leading ransomware-as-a-service (RaaS) operation — and explore how it’s reshaping the cybercrime landscape in 2025. Qilin, also known as Agenda, burst onto the scene in 2022 with a Go-based ransomware. It has since evolved into a highly evasive Rust-based malware platform targeting both Windows and L...

In this episode, we dive deep into the story behind CVE-2025-27363, a critical zero-click vulnerability in the widely used FreeType font rendering library. Initially discovered by Facebook’s security team and patched by Google in May 2025, this flaw allowed attackers to execute arbitrary code on Android devices—without any user interaction—by exploiting how FreeType parsed certain font structures....

In this episode, we take a deep dive into the June 2025 cyberattack on Aflac, one of the latest strikes in a growing wave of sophisticated, AI-driven cyber campaigns targeting the insurance industry. On June 12, Aflac detected suspicious activity within its U.S. network—a breach attributed to a highly organized cybercrime group and part of a larger pattern of targeted attacks against financial and...

In May 2025, a ransomware attack forced Nucor — one of America’s largest steel producers — to halt its metal production operations. This wasn’t just a corporate IT incident: it disrupted a critical link in the nation’s industrial supply chain. In this episode, we take an in-depth look at the Nucor attack: how cybercriminals targeted operational technology (OT) systems, why manufacturers like Nucor...

A staggering $225 million in illicit cryptocurrency was recently seized by U.S. authorities in what has become the largest digital asset recovery in Secret Service history. This episode unpacks the mechanics, methods, and forensics that made this possible—and how a sprawling network of scams, labor compounds, and fake identities in Southeast Asia unraveled under blockchain scrutiny. We explore how...

Ransomware groups are no longer just encrypting data — they're going straight for the backups. And if those backups aren’t properly protected, recovery becomes impossible, and ransom payouts more likely. In this episode, we dive deep into how threat actors are exploiting critical vulnerabilities in widely used backup systems, focusing on the recently disclosed CVEs affecting Veeam Backup & Rep...

Ransomware just bankrupted a 100-year-old manufacturer—and the world should take notice. In this episode, we dissect the cyberattack that brought down Fasana , a German paper napkin producer, and pushed it into insolvency. On May 19, 2025, employees arrived to find printers ejecting extortion notes. By the end of the week, systems were paralyzed, €250,000 in daily orders went unprocessed, and the...

In this episode, we break down the true scale and mechanics behind the largest credential leak ever recorded— over 16 billion login credentials , most of them exfiltrated by infostealer malware. We dive into how this happened: from the malware-as-a-service (MaaS) model enabling even low-skill threat actors to deploy powerful stealers, to how credentials are harvested from infected systems, bundled...

A malware distribution network hiding in plain sight — on GitHub. This episode unpacks the Stargazers Ghost Network , a massive Distribution-as-a-Service (DaaS) infrastructure run by a threat actor known as Stargazer Goblin . Using over 3,000 GitHub accounts , this operation pushes dangerous information-stealing malware disguised as legitimate game mods and cracked software, particularly targeting...

Cybercriminals are increasingly turning GitHub into a malware distribution network. In this episode, we unpack two of the most alarming recent campaigns: Water Curse and Banana Squad — both targeting developers, red teams, and security professionals through poisoned open-source projects. Water Curse, a financially motivated group, used at least 76 GitHub accounts to deliver multistage malware hidd...

A single vendor was compromised — and suddenly, internal records from UBS, Pictet, Manor, and Implenia were leaked. The Chain IQ cyberattack is a textbook example of how fragile the digital supply chain has become. This episode dissects the breach that exposed names, roles, phone numbers, even CEO contact details of over 137,000 UBS employees, and 230,000 lines of internal billing data from Pictet...

State and local governments are under cyber siege. In this episode, we break down how and why these public institutions have become top targets for attackers — and why the threats are getting worse. Digitization is expanding public access to services, but it's also opening new doors for threat actors. Many local authorities still rely on legacy IT systems, outdated operating systems, and unsupport...

Two newly disclosed critical vulnerabilities— CVE-2025-5349 and CVE-2025-5777 —have put Citrix NetScaler ADC and Gateway deployments at serious risk, exposing enterprise environments to potential data breaches and service disruptions. These flaws underscore the persistent challenges facing infrastructure teams, especially when balancing security patching with service availability. We dive deep int...

CVE-2025-1568, dubbed "GerriScary" , has shaken the open-source ecosystem by exposing a fundamental weakness in Google’s Gerrit code review system—one that could have enabled attackers to infiltrate 18 of Google’s most widely used open-source projects, including Chromium, ChromiumOS, Dart , and Bazel . This episode breaks down how the vulnerability was discovered by researchers at Tenable using a...

Cisco and Atlassian have both released urgent security advisories in response to newly discovered high-severity vulnerabilities—and the implications are serious. Cisco’s firmware flaws impact Meraki MX and Z Series devices running AnyConnect VPN. A bug in the SSL VPN process allows authenticated attackers to crash the VPN server, causing repeated denial-of-service conditions. Cisco ClamAV also con...

A deep dive into one of the most aggressive ransomware groups operating today— Play —and their latest high-profile target: Krispy Kreme . Operating since 2022, the Play ransomware group has become notorious for its double extortion model , where sensitive data is exfiltrated before systems are encrypted. Victims are pressured not just by digital ransom notes but also through direct phone calls to...

In this episode, we unpack the dramatic takedown of Archetyp Market , a darknet marketplace that dominated the online drug trade since its launch in May 2020. With over €250 million ($290 million) in drug transactions, more than 600,000 users , and 17,000 listings , Archetyp wasn’t just another darknet forum—it was the largest dedicated drug market on the Tor network by 2024. The operation that br...

In this episode, we break down one of 2025’s most significant healthcare cybersecurity incidents: the ransomware attack on Ocuco, a global eyecare software provider. On April 1st, 2025, threat actors from the KillSec ransomware group exploited CVE-2024-41197 — a critical authentication bypass in Ocuco’s INVCLIENT.EXE — to gain Administrator-level access and exfiltrate over 340GB of sensitive data...

In this episode, we dive deep into the current state of cybersecurity in healthcare, where the growing sophistication of cyber threats has led to increasingly devastating breaches. We begin with a close look at the rise of Ransomware-as-a-Service (RaaS), focusing on DragonForce, a ransomware group that has transitioned from politically motivated attacks to financially-driven extortion campaigns. W...

In this episode, we break down the seismic implications of Google’s proposed $32 billion acquisition of Wiz , the world’s largest cybersecurity unicorn—and why this isn’t just another tech deal. At the core is the U.S. Department of Justice's antitrust investigation , triggered by concerns that the deal could tighten Google’s grip on a critical sector: multi-cloud cybersecurity . With Wiz already...

In this critical episode, we dive into the alarming exploitation of CVE-2024-57727, a vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software actively leveraged by ransomware operators since early 2025. This isn't just a theoretical risk—it's already being used to compromise utility billing providers and downstream MSP customers through double extortion tactics. We examine how...

In this episode, we dissect UNK_SneakyStrike—a major account takeover campaign targeting Microsoft Entra ID users with precision and scale. Tracked by Proofpoint, this campaign began in December 2024 and has since escalated, leveraging TeamFiltration, a legitimate penetration testing tool, to enumerate users and launch password spraying attacks that have compromised over 80,000 accounts across 100...